Pivotal Tracker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:09 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent Pivotal Tracker connector, but its first-time setup tells users to execute remote installer scripts directly without verification.

Install only after reviewing the oo CLI source and installer path through official OOMOL channels, preferably using a pinned or signed installer instead of piping remote content directly to a shell. For normal use, confirm any story creation, comment creation, or state update before allowing the skill to run it.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:63

Finding

Remote Shell Script Downloaded and Executed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:63
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

bash

curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation command pipes a remotely downloaded shell script directly into bash. The payload is not pinned to a specific immutable release and is not validated using a cryptographic checksum or signature. Consequently, the code ultimately executed can change after the Skill has been reviewed.

HTTPS provides transport protection but does not make the remote payload immutable. Compromise of the hosting service, publishing account, DNS infrastructure, TLS termination environment, or installation endpoint could cause this instruction to execute attacker-controlled shell commands.

Installing the required CLI is consistent with the Skill's functionality, but immediate remote-to-shell execution is not necessary and exceeds the minimum safe installation mechanism.

Attack Path

1. An attacker compromises the installation endpoint or infrastructure capable of controlling its response.
2. The attacker replaces install.sh with a malicious shell payload.
3. A user or agent encounters an oo: command not found error and follows the documented first-time setup.
4. curl retrieves the modified payload and passes it directly to bash.
5. The payload executes with the privileges of the account that invoked the command.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's privileges. The payload could read or alter files available to that account, access locally available credentials, modify shell configuration, install additional software, or establish persistence. If the installation command is run from a privileged account or elevated shell, the resulting impact could extend to system-wide compromise.

Remediation

View remediation

Remediation Suggestions

• Remove the direct curl | bash installation pattern.
• Download a version-pinned release artifact to a local file before execution.
• Verify the artifact against a cryptographic checksum obtained through a separately authenticated channel.
• Prefer a cryptographically signed release and verify its signature against a documented, trusted maintainer key.
• Allow users to inspect the downloaded script before explicitly executing it.
• Prefer an official signed package-manager distribution where available.
• Run installation with ordinary user privileges unless a documented operation strictly requires elevation.
• Document the exact release version and expected checksum so the reviewed payload cannot silently change.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:67

Finding

Remote PowerShell Script Downloaded and Executed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:67
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

powershell

irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The PowerShell installation instruction obtains a remote script with Invoke-RestMethod (irm) and immediately evaluates it with Invoke-Expression (iex). No version pinning, signature verification, checksum validation, or local review occurs before execution.

This creates a mutable remote code-execution channel: changes to the endpoint's response become executable PowerShell code without requiring any change to the audited Skill. Although HTTPS protects data in transit, it does not mitigate compromise of the hosting endpoint, release account, or associated delivery infrastructure.

Installation of the CLI may be necessary for the declared connector functionality, but evaluating unverified network content directly is not required and violates least-risk installation practices.

Attack Path

1. An attacker gains control over the PowerShell installation response through compromise of the hosting or delivery infrastructure.
2. The attacker modifies install.ps1 to include malicious PowerShell commands.
3. A user or agent follows the first-time setup instruction after the required CLI is not found.
4. irm downloads the attacker-controlled content and pipes it directly to iex.
5. PowerShell evaluates the payload with the invoking process's privileges.

Impact Assessment

Successful exploitation permits arbitrary PowerShell execution as the invoking user. This may allow access to user-readable files and credentials, modification of user configuration, downloading and launching additional payloads, or creation of persistence mechanisms. Execution from an elevated PowerShell session could permit system-level changes and affect other users on the host.

Remediation

View remediation

Remediation Suggestions

• Remove the irm | iex execution pattern.
• Publish immutable, versioned installation artifacts instead of executing a mutable endpoint response.
• Download the installer to disk and verify an Authenticode signature from an expected publisher before execution.
• Publish and validate a SHA-256 or stronger checksum through an independently authenticated release channel.
• Give users an opportunity to inspect the script before explicitly invoking it.
• Prefer a signed Windows package distributed through a trusted package manager.
• Avoid requesting administrator privileges unless a specific installation step demonstrably requires them.
• Document the pinned version, signer identity, and expected digest in the setup instructions.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill instructs users to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This bypasses integrity verification and gives the remote server full code-execution capability on the host, so a compromised server, CDN, DNS path, or TLS trust chain could result in arbitrary command execution.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says to use this skill for "ANY Pivotal Tracker request" and "Whenever a task involves Pivotal Tracker," which is an extremely broad activation condition without boundaries or exclusions. This can overlap with many routine mentions of Pivotal Tracker and does not specify narrower trigger phrases or negative examples to prevent accidental invocation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.